All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is using an AWS CloudFormation template to deploy an application that includes an Amazon S3 bucket. The S3 bucket contains critical application logs that must be preserved. The developer wants to ensure that the S3 bucket is not deleted when the CloudFormation stack is deleted.

Which action should the developer take to meet this requirement?

Define the S3 bucket in the template and reference its deletion protection settings from AWS Systems Manager Parameter Store.

Manually modify the S3 bucket configuration in the AWS Management Console to enable deletion protection before deleting the stack.

Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.

Configure the stack to fail and rollback to the ROLLBACK_COMPLETE state if the S3 bucket deletion is initiated.

Show answer & explanation

Answer: Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.

Answer

Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.

The DeletionPolicy attribute in AWS CloudFormation enables you to preserve or back up a resource when its stack is deleted. Setting this policy to Retain on the S3 bucket resource ensures the bucket remains active and intact in the AWS account even after the parent stack is deleted.

Step-by-Step Solution

Identify the target resource (the Amazon S3 bucket) that needs to be preserved.

The target resource is defined in the CloudFormation template.

You must modify the resource's configuration directly in the template definition.

Add the DeletionPolicy attribute to the S3 bucket resource block.

The DeletionPolicy attribute is set to Retain.

The Retain policy instructs AWS CloudFormation to keep the resource without deleting it when the stack is deleted.

Deploy the updated CloudFormation template.

The stack is updated with the resource retention policy in place.

This ensures that subsequent stack deletion operations will preserve the S3 bucket.

Key Concept

AWS CloudFormation DeletionPolicy

Estimated Time:45s

Question 742Question →

A developer is managing a release pipeline in AWS CodePipeline that contains Source, Build, and Deploy stages. The developer wants to temporarily prevent new builds from automatically entering the Deploy stage while a production issue is being investigated, without stopping or deleting the pipeline. Which action should the developer take to meet this requirement?

Modify the trust policy of the CodePipeline service role to deny the permissions required to run the Deploy stage.

Disable the transition between the Build stage and the Deploy stage in CodePipeline.

Store a configuration parameter in AWS Systems Manager Parameter Store to control the Deploy stage status.

Modify the KMS key policy for the artifact S3 bucket to deny decryption rights to the Deploy stage action.

Show answer & explanation

Answer: Disable the transition between the Build stage and the Deploy stage in CodePipeline.

Answer

Disable the transition between the Build stage and the Deploy stage in CodePipeline.

Disabling the transition between stages in AWS CodePipeline prevents executions from moving from the upstream stage (Build) to the downstream stage (Deploy). This is the standard, built-in feature designed specifically for this purpose, allowing executions to compile and build while holding them before the deploy phase.

Step-by-Step Solution

Identify the requirement to temporarily halt the flow of executions into a specific stage without disabling the upstream stages or deleting the pipeline.

Recognized that the pipeline transition between the Build and Deploy stages needs to be controlled.

This isolates the Deploy stage from new incoming changes while allowing build testing to continue.

Evaluate AWS CodePipeline features for controlling pipeline flow and execution transitions between stages.

Identified that disabling stage transitions is the built-in mechanism for this use case.

Stage transitions can be enabled or disabled dynamically without changing permissions or configuration store parameters.

Select the option to disable the transition between the Build stage and the Deploy stage, which cleanly pauses executions at the boundary.

Correctly determined the operational action to resolve the scenario.

This is the most efficient and native method provided by CodePipeline.

Key Concept

AWS CodePipeline Stage Transitions

Question 743Question →

A company is deploying a new version of a microservice on Amazon ECS (Fargate) behind an Application Load Balancer (ALB). The deployment uses AWS CodeDeploy to perform a blue/green deployment. The ALB is configured with two target groups: one for production traffic on port 80, and one for test traffic on port 8080.

The deployment must satisfy the following requirements:
1. Route $10\%$ of production traffic to the replacement task set (Green) initially, and then route the remaining $90\%$ after a 15-minute wait period.
2. Run automated validation tests against the replacement task set using the test traffic port (8080) before any production traffic is shifted.
3. Automatically roll back the deployment if the validation tests fail or if a CloudWatch alarm monitoring 5XX errors triggers during the 15-minute wait period.

Which configuration should the developer specify in the CodeDeploy deployment configuration and the AppSpec file to meet these requirements?

Use CodeDeployDefault.ECSCanary10Percent15Minutes as the deployment configuration. In the AppSpec file, specify the validation test Lambda function under the AfterAllowTestTraffic hook.

Use CodeDeployDefault.ECSCanary10Percent15Minutes as the deployment configuration. In the AppSpec file, specify the validation test Lambda function under the ValidateService hook.

Use CodeDeployDefault.ECSLinear10PercentEvery3Minutes as the deployment configuration. In the AppSpec file, specify the validation test Lambda function under the AfterAllowTestTraffic hook.

Use CodeDeployDefault.ECSCanary10Percent15Minutes as the deployment configuration. In the AppSpec file, specify the validation test Lambda function under the BeforeInstall hook.

Show answer & explanation

Answer: Use CodeDeployDefault.ECSCanary10Percent15Minutes as the deployment configuration. In the AppSpec file, specify the validation test Lambda function under the AfterAllowTestTraffic hook.

Answer

Use CodeDeployDefault.ECSCanary10Percent15Minutes as the deployment configuration and run the validation tests under the AfterAllowTestTraffic hook in the AppSpec file.

The configuration using CodeDeployDefault.ECSCanary10Percent15Minutes correctly implements the required traffic shifting (10% initially, wait 15 minutes, then shift the remaining 90%). In an ECS blue/green deployment, the AfterAllowTestTraffic hook is executed after the test listener begins routing traffic to the green task set, making it the correct place to run validation tests on port 8080 before production traffic begins shifting.

Step-by-Step Solution

Analyze the traffic shifting requirement

The requirement is to route 10% of traffic initially, wait 15 minutes, and then route the remaining 90%. This matches the Canary deployment pattern with a 10% initial shift and a 15-minute bake period, represented by the built-in configuration CodeDeployDefault.ECSCanary10Percent15Minutes.

Choosing the correct deployment configuration ensures traffic shifting conforms to the SLA and rollback windows.

Identify the lifecycle hook for testing on the test port

The AfterAllowTestTraffic hook is run immediately after the test listener starts routing test traffic to the replacement task set, but before any production traffic is shifted. This is the correct lifecycle hook to trigger a Lambda function to perform validation tests.

Placing validation tests in the correct lifecycle hook ensures that failures can trigger a rollback before production users are affected.

Configure the rollback mechanism

If the validation Lambda function fails (returns a failure status to CodeDeploy) or if the CloudWatch alarm triggers during the 15-minute baking period, CodeDeploy will automatically initiate a rollback to the original task set.

Ensures the deployment is safe and automatically rolls back on error detection.

Key Concept

AWS CodeDeploy ECS Blue/Green Deployment Lifecycle Hooks and Deployment Configurations

Estimated Time:3m 0s

Question 744Question →

A developer is configuring security for an Amazon API Gateway REST API that serves a client web portal. The portal users authenticate using an external, non-AWS identity provider that issues JSON Web Tokens (JWT). The developer wants to validate these tokens at the API Gateway boundary before requests are forwarded to a backend integration. Which API Gateway authorization method should the developer use to validate the tokens with the least operational complexity?

Configure a Lambda authorizer to validate the JWT directly against the external identity provider's public keys.

Configure an Amazon Cognito User Pool authorizer to validate the third-party JWT directly at the API Gateway level.

Configure an Amazon Cognito Identity Pool authorizer to validate the JWT and generate temporary AWS credentials to sign the request.

Configure a Lambda proxy integration and perform token validation inside the backend integration Lambda function.

Show answer & explanation

Answer: Configure a Lambda authorizer to validate the JWT directly against the external identity provider's public keys.

Answer

Configure a Lambda authorizer to validate the JWT directly against the external identity provider's public keys.

Configuring a Lambda authorizer allows API Gateway to call a custom Lambda function to validate bearer tokens (like JWTs) issued by any third-party identity provider. The function verifies the token signature against the provider's public keys and returns an IAM policy to allow or deny the request, securing the API at the boundary.

Step-by-Step Solution

Analyze the token source and type.

The token is a JSON Web Token (JWT) issued by an external, non-AWS identity provider.

Understanding the token source determines which native and custom integration options are compatible.

Evaluate native API Gateway authorizers.

Amazon Cognito User Pool authorizers cannot directly validate external JWTs without a Cognito User Pool wrapping them, and IAM authorization requires Signature Version 4 signatures.

This rules out native authorizers that require specific token issuers or request signing mechanisms.

Select the correct custom authorization method.

A Lambda authorizer (custom authorizer) is the appropriate choice as it runs custom code to validate external JWTs and return the required IAM policy.

Using a Lambda authorizer enforces security validation at the API Gateway boundary rather than letting unauthorized traffic reach backend integrations.

Key Concept

API Gateway Lambda Authorizers for external identity providers

Estimated Time:1m 30s

Question 745Question →

A three-tier web application hosted on AWS is experiencing performance degradation. The database tier uses a single Amazon DynamoDB table that experiences high read traffic on specific partition keys, leading to ProvisionedThroughputExceededException errors. Concurrently, the application's auto-scaled Amazon EC2 instances are failing to share user login sessions because session data is stored locally. The developer needs to resolve both the database read bottlenecks and externalize the session state with minimal application latency. Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Implement Amazon DynamoDB Accelerator (DAX) in front of the database table to cache read responses.

Configure an Amazon ElastiCache for Redis cluster to serve as a centralized, replication-enabled session store.

Scale up the provisioned read capacity units (RCUs) of the DynamoDB table to handle the surge in read requests.

Execute a periodic DynamoDB Scan operation to pre-load all user sessions into a local server cache.

Store the user session states as parameters in AWS Systems Manager Parameter Store to enable stateless scaling.

Show answer & explanation

Answer: Implement Amazon DynamoDB Accelerator (DAX) in front of the database table to cache read responses.; Configure an Amazon ElastiCache for Redis cluster to serve as a centralized, replication-enabled session store.

Answer

Implement Amazon DynamoDB Accelerator (DAX) to resolve the database read bottlenecks on hot keys, and configure Amazon ElastiCache for Redis as the centralized external session store.

The correct architecture uses Amazon DynamoDB Accelerator (DAX) to resolve read hot spots by caching queries in-memory at microsecond latency without changing application code. To support stateless scaling, the application should externalize its local session state to a centralized Amazon ElastiCache for Redis cluster, which provides replication, failover, and sub-millisecond performance.

Step-by-Step Solution

Analyze the database bottleneck and identify that the ProvisionedThroughputExceededException is caused by hot partition keys on the Amazon DynamoDB table.

Determine that an in-memory caching layer specifically designed for DynamoDB (like DAX) is required to reduce latency to microseconds and offload reads from hot keys.

Simply scaling up provisioned throughput (RCUs) cannot overcome the physical limits of a single hot partition, whereas DAX caches the reads transparently.

Analyze the session state requirement to enable stateless horizontal scaling for Amazon EC2 instances.

Identify that session state must be externalized to a high-performance, key-value store with replication and failover support.

Amazon ElastiCache for Redis supports the high-frequency read/write patterns and sub-millisecond latencies needed for session store management, while providing high availability.

Key Concept

Using specialized caches (DAX for DynamoDB reads, ElastiCache for Redis for session state) to offload database load and externalize state for stateless application scaling.

Question 746Question →

A developer is configuring an automated build pipeline using AWS CodePipeline. The pipeline is configured to trigger automatically when a ZIP file containing the application source code is uploaded to a specific Amazon S3 bucket, build the application using AWS CodeBuild, and store the output in another bucket. Order the sequence of events that occurs from the developer uploading the ZIP file to the start of the AWS CodeBuild execution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of events starts with the developer uploading the ZIP file to S3, followed by EventBridge detecting the event and triggering CodePipeline, which then downloads the file to the S3 artifact store and subsequently passes it to AWS CodeBuild to start the build.

The correct order follows the event-driven trigger flow: uploading to S3, detection of the S3 event by EventBridge, matching the target rule to trigger CodePipeline, fetching and saving the source code into the pipeline S3 artifact store, and finally starting CodeBuild with the artifact.

Step-by-Step Solution

Upload the source code archive to S3.

The S3 object creation event is emitted.

This is the initial action that starts the event-driven workflow.

EventBridge detects the S3 object creation event.

The event is captured and evaluated by EventBridge rules.

EventBridge acts as the serverless event router between Amazon S3 and CodePipeline.

The matched EventBridge rule triggers CodePipeline.

CodePipeline receives the trigger and starts a new pipeline execution.

The rule target is configured to initiate the execution of the pipeline.

CodePipeline runs the Source stage and writes the ZIP file to the artifact store S3 bucket.

The ZIP file is saved as an input artifact.

CodePipeline must store the retrieved source code in its internal artifact store so that downstream actions like CodeBuild can access it.

CodePipeline triggers CodeBuild with the input artifact.

CodeBuild receives the source bundle from the artifact store and begins the build.

The Build stage action is executed with the input artifact specified in the pipeline configuration.

Key Concept

AWS CodePipeline S3 and EventBridge Event Integration and Artifact Flow

Estimated Time:1m 30s

Question 747Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline to deploy a serverless web application. The pipeline is created in the us-east-1 region. The release process must deploy AWS CloudFormation stacks to both us-east-1 and us-west-2 during the deployment stage. The pipeline execution fails during the cross-region deployment action because of issues with artifact access between regions. Which two configurations must the developer implement to support this cross-region deployment?

Select all that apply

Configure a customer managed AWS KMS key in both the us-east-1 and us-west-2 regions to encrypt and decrypt the deployment artifacts.

Include an Amazon S3 artifact store bucket in each region where a pipeline action is executed within the pipeline definition.

Configure the pipeline to use the default AWS managed S3 key (aws/s3) in each region to automatically handle cross-region artifact encryption.

Store cross-region target deployment credentials in AWS Systems Manager Parameter Store and enable native automatic rotation of the credentials.

Update the IAM trust policy of the CodePipeline service role to allow the AWS CloudFormation service principal to directly assume the role.

Show answer & explanation

Answer: Configure a customer managed AWS KMS key in both the us-east-1 and us-west-2 regions to encrypt and decrypt the deployment artifacts.; Include an Amazon S3 artifact store bucket in each region where a pipeline action is executed within the pipeline definition.

Answer

Configure a customer managed AWS KMS key in both the us-east-1 and us-west-2 regions, and include an Amazon S3 artifact store bucket in each region where a pipeline action is executed.

To configure cross-region actions in AWS CodePipeline, a regional S3 artifact store bucket must be configured in each region where actions are executed. Additionally, a customer managed AWS KMS key must be configured in each region to encrypt and decrypt artifacts stored in these regional S3 buckets because default AWS managed keys are not supported for cross-region actions.

Step-by-Step Solution

Analyze cross-region action requirements in AWS CodePipeline.

Identify that CodePipeline requires a separate S3 bucket in each region where an action is executed to act as a regional artifact store.

Artifacts must be stored locally in the region of execution to prevent latency and allow regional services to access them.

Determine the encryption requirements for cross-region artifact stores.

Identify that a customer managed KMS key must be configured in each region to encrypt and decrypt the artifacts.

Default AWS managed S3 keys (aws/s3) cannot be used for cross-region actions because they cannot be used to decrypt artifacts across regional or account boundaries by the pipeline's service role.

Evaluate the distractors against the requirements.

Reject the options proposing default AWS managed S3 keys, Parameter Store for automatic secret rotation, and modifying the CodePipeline trust policy for CloudFormation.

These distractors rely on incorrect assumptions about AWS managed keys, Parameter Store capabilities, and IAM trust relationship delegations.

Key Concept

AWS CodePipeline Cross-Region Action Configurations

Question 748Question →

A developer needs to improve the read performance of an application that frequently queries an Amazon DynamoDB table. The application requires sub-millisecond response times for these queries with minimal modifications to the application's existing database query code. Which solution should the developer implement?

Perform a DynamoDB Scan operation instead of a Query to retrieve all items into application memory during start-up.

Configure AWS Systems Manager Parameter Store to store the query results and retrieve them during each request.

Enable Amazon DynamoDB Accelerator (DAX) and configure the application to use the DAX client SDK.

Increase the provisioned read capacity units (RCUs) on the DynamoDB table and use an IAM role to authorize the additional capacity.

Show answer & explanation

Answer: Enable Amazon DynamoDB Accelerator (DAX) and configure the application to use the DAX client SDK.

Answer

Enable Amazon DynamoDB Accelerator (DAX) and configure the application to use the DAX client SDK.

Amazon DynamoDB Accelerator (DAX) is an API-compatible in-memory cache designed specifically for DynamoDB. It provides sub-millisecond response times for read operations and requires only updating the client configuration rather than rewriting query logic.

Step-by-Step Solution

Identify the performance requirement for sub-millisecond query latency on an Amazon DynamoDB table.

Determine that an in-memory caching layer is required to reduce latency from single-digit milliseconds to microseconds.

This filters the options to mechanisms that provide database caching.

Evaluate the requirement for minimal application code changes.

Identify Amazon DynamoDB Accelerator (DAX) as the only caching option that is fully API-compatible with DynamoDB, requiring only a client SDK change rather than rewriting queries.

Other options require complex cache-aside logic or are not suitable for high-throughput databases.

Key Concept

Using Amazon DynamoDB Accelerator (DAX) for sub-millisecond caching with minimal application code modifications

Question 749Question →

A developer is writing an AWS Lambda function that receives customer registration data payloads of approximately $50\text{ KB}$ each. The security policy requires this data to be encrypted client-side using a Customer Managed Key (CMK) in AWS KMS before it is written to an Amazon DynamoDB table. Which of the following steps must the developer perform to encrypt the payload and store it in DynamoDB? (Select TWO.)

Select all that apply

Call the GenerateDataKey API operation on AWS KMS using the Customer Managed Key to receive both a plaintext data key and an encrypted data key.

Encrypt the payload locally using the plaintext data key, store both the encrypted payload and the encrypted data key in the DynamoDB table, and erase the plaintext data key from memory.

Call the Encrypt API operation on AWS KMS directly, passing the entire

50\text{ KB}

payload and the Customer Managed Key identifier.

Call the GenerateDataKeyWithoutPlaintext API operation on AWS KMS to get an encrypted data key, decrypt the key locally using the AWS SDK offline utilities, and encrypt the payload.

Encrypt the payload locally using the plaintext data key, and store the plaintext data key in AWS Systems Manager Parameter Store with a secure string type for later decryption.

Show answer & explanation

Answer: Call the GenerateDataKey API operation on AWS KMS using the Customer Managed Key to receive both a plaintext data key and an encrypted data key.; Encrypt the payload locally using the plaintext data key, store both the encrypted payload and the encrypted data key in the DynamoDB table, and erase the plaintext data key from memory.

Answer

The developer must call the GenerateDataKey API operation to obtain the plaintext and encrypted data keys, encrypt the data locally, store the encrypted payload and the encrypted data key in DynamoDB, and immediately purge the plaintext data key from memory.

Because the payload (

50\text{ KB}

) is larger than the

4\text{ KB}

maximum allowed by the direct AWS KMS Encrypt API, envelope encryption is required. The developer calls GenerateDataKey to obtain both the plaintext data key (for local encryption) and the encrypted data key. After local encryption, the plaintext key is discarded from memory, and the encrypted data key is stored alongside the encrypted payload in DynamoDB.

Step-by-Step Solution

Determine the encryption strategy based on payload size.

Since the

50\text{ KB}

payload exceeds the

4\text{ KB}

direct encryption limit of AWS KMS, client-side envelope encryption must be used.

Direct KMS Encrypt/Decrypt APIs cannot handle payloads larger than

4096

bytes.

Request a data key from AWS KMS.

Invoke the GenerateDataKey API using the Customer Managed Key identifier to receive both the plaintext data key and the encrypted data key.

This provides the required cryptographic material for local encryption and safe storage of the key.

Encrypt the data locally and manage the keys.

Encrypt the data using the plaintext key, erase the plaintext key from memory, and write the encrypted payload along with the encrypted data key to DynamoDB.

This secures the payload client-side while ensuring the plaintext key is never stored, complying with security best practices.

Key Concept

KMS Client-Side Envelope Encryption and Payload Size Limits

Estimated Time:1m 30s

Question 750Question →

A developer is configuring security for a new REST API in Amazon API Gateway. The API must restrict access to only those clients who authenticate via an Amazon Cognito User Pool. Which of the following steps must the developer perform to implement this authorization? (Select TWO.)

Select all that apply

Create an Amazon Cognito User Pool authorizer in the API Gateway console.

Configure the API methods to use the Cognito User Pool authorizer in the Method Request settings.

Create a custom Lambda authorizer to manually decode and validate the JSON Web Tokens (JWTs) from the Cognito User Pool.

Configure an Amazon Cognito Identity Pool to authenticate users and generate temporary AWS IAM credentials for API Gateway.

Enable Lambda proxy integration and implement JWT validation logic inside the backend AWS Lambda function.

Show answer & explanation

Answer: Create an Amazon Cognito User Pool authorizer in the API Gateway console.; Configure the API methods to use the Cognito User Pool authorizer in the Method Request settings.

Answer

To configure authorization via a Cognito User Pool, the developer must create a Cognito User Pool authorizer in API Gateway and update the Method Request settings of the API methods to use this authorizer.

To authenticate API clients against an Amazon Cognito User Pool natively, the developer must first define a Cognito User Pool authorizer at the API Gateway level. Once the authorizer is defined, the developer must configure the specific REST API methods to use this authorizer under Method Request settings, ensuring that incoming requests are automatically validated.

Step-by-Step Solution

Create the Amazon Cognito User Pool authorizer.

The authorizer is successfully configured and linked to the target Amazon Cognito User Pool.

This registers the User Pool with API Gateway so it can perform token verification.

Update the API method settings.

The method's authorization is set to the newly created Cognito authorizer.

This ensures that API Gateway actively protects the method, requiring clients to provide a valid token.

Key Concept

Amazon API Gateway Cognito User Pool Authorizer

Question 751Question →

A developer is configuring a CI/CD pipeline in AWS CodePipeline. The pipeline consists of a Source stage, a Build stage running AWS CodeBuild, and a Deploy stage running AWS CloudFormation. During the Build stage, CodeBuild executes a script that generates a dynamic configuration token required by the CloudFormation template as a parameter named ConfigToken. The pipeline must support concurrent executions without resource state conflicts, out-of-band credential dependencies, or exposure of sensitive data. Which configuration should the developer implement to pass this dynamic token to the CloudFormation deployment action?

Write the dynamic token to AWS Secrets Manager using an AWS SDK call during the build phase. In the CloudFormation Deploy action, reference the token in the template parameters using the dynamic reference pattern {{resolve:secretsmanager:ConfigToken}}.

Generate a variables.json file containing the token in a subdirectory of the repository during the build. Configure CodePipeline to pass this subdirectory as a secondary input artifact to the Deploy stage, and reference it in the CloudFormation ParameterOverrides using the syntax SecondaryArtifact::variables.json::ConfigToken.

Define ConfigToken under exported-variables in the env section of the CodeBuild buildspec.yml and assign the value during the build phase. Set a Namespace (e.g., BuildVariables) in the CodePipeline build action, and configure the CloudFormation Deploy action ParameterOverrides using the format {"ConfigToken": "#{BuildVariables.ConfigToken}"}.

Configure the CodeBuild service role with a trust policy that allows it to assume the CodePipeline service role. During the build phase, execute a script that calls the AWS CLI update-pipeline command to modify the default parameter values of the pipeline's CloudFormation Deploy stage.

Show answer & explanation

Answer: Define ConfigToken under exported-variables in the env section of the CodeBuild buildspec.yml and assign the value during the build phase. Set a Namespace (e.g., BuildVariables) in the CodePipeline build action, and configure the CloudFormation Deploy action ParameterOverrides using the format {"ConfigToken": "#{BuildVariables.ConfigToken}"}.

Answer

Define the ConfigToken under exported-variables in the env section of the buildspec.yml, set a Namespace on the CodePipeline build action, and reference it in the CloudFormation ParameterOverrides using the format {"ConfigToken": "#{BuildVariables.ConfigToken}"}.

The correct option is to define ConfigToken under exported-variables in the env section of the CodeBuild buildspec.yml, assign a Namespace to the Build action, and configure the CloudFormation ParameterOverrides using the syntax #{Namespace.Variable}. CodePipeline natively supports variable sharing across actions using execution namespaces. Each execution has its own runtime scope, which ensures that concurrent pipeline runs remain isolated and do not overwrite each other's data.

Step-by-Step Solution

Export the variable in CodeBuild

ConfigToken is defined under the exported-variables key in the buildspec's env section.

This registers the variable with AWS CodeBuild, making it eligible to be captured by AWS CodePipeline upon build completion.

Assign a namespace to the Build action

The Build stage action configuration is updated with a Namespace property (e.g., BuildVariables).

Creating a namespace allows other actions within the same pipeline execution path to access the output variables of this specific action.

Reference the namespace variable in the CloudFormation action

The ParameterOverrides parameter is set to reference the variable using #{BuildVariables.ConfigToken}.

CodePipeline dynamically interpolates variables using the #{Namespace.VariableName} format during execution, ensuring isolation and supporting concurrency.

Key Concept

AWS CodePipeline variables and namespaces

Question 752Question →

A developer is designing a deployment strategy for a high-traffic microservice running on Amazon ECS (Fargate). The service has a desired count of 8 tasks. Due to strict vCPU and memory service quotas in the AWS region, the deployment process must never run more than the 8 desired tasks at any point during the update. Additionally, to handle baseline traffic and prevent downtime, at least 4 healthy tasks must remain in service throughout the deployment. Which deployment strategy and configuration should the developer choose to meet these requirements?

An ECS rolling update with the minimum healthy percent set to 50% and the maximum percent set to 100%.

An ECS rolling update with the minimum healthy percent set to 100% and the maximum percent set to 150%.

An AWS CodeDeploy Blue/Green deployment with a Canary traffic-shifting configuration.

An ECS rolling update with the minimum healthy percent set to 0% and the maximum percent set to 100%.

Show answer & explanation

Answer: An ECS rolling update with the minimum healthy percent set to 50% and the maximum percent set to 100%.

Answer

An ECS rolling update with the minimum healthy percent set to 50% and the maximum percent set to 100%.

The correct strategy is a rolling update with the minimum healthy percent set to 50% and the maximum percent set to 100%. In Amazon ECS, setting the minimum healthy percent to 50% with a desired task count of 8 guarantees that at least 4 tasks (8 * 0.50) will remain running and healthy at all times during the deployment, preventing downtime. Setting the maximum percent to 100% restricts the total number of tasks to 8 (8 * 1.00), ensuring the service never exceeds the desired task count and respects the strict resource quotas. ECS will stop 4 old tasks first to make room under the 100% limit, start 4 new tasks, wait for them to become healthy, and then repeat the process for the remaining tasks.

Step-by-Step Solution

Analyze the constraints given in the scenario.

Desired count is 8 tasks. Maximum allowed concurrent tasks is 8 (100% of desired). Minimum required healthy tasks is 4 (50% of desired).

This establishes the bounds for the maximum capacity percent and the minimum healthy capacity percent.

Evaluate the rolling update configuration options against the constraints.

A minimum healthy percent of 50% (4 tasks) and a maximum percent of 100% (8 tasks) matches the capacity bounds exactly.

ECS calculates these percentages relative to the desired task count to determine how many tasks can be stopped and started during a deployment.

Evaluate the Blue/Green deployment option.

CodeDeploy Blue/Green deployments for ECS spin up a full replacement task set (8 additional tasks, totaling 16), which violates the resource quota constraint.

Blue/Green deployment requires duplicate resource capacity during the cutover phase.

Key Concept

Configuring rolling update parameters (minimumHealthyPercent and maximumPercent) in Amazon ECS to control deployment capacity limits and maintain service availability.

Estimated Time:2m 0s

Question 753Question →

An organization runs an internal test environment on AWS Elastic Beanstalk. The system administrator wants to update the application version with zero budget for temporary resource overhead, meaning no additional EC2 instances can be launched during the update. A temporary reduction in application performance or brief downtime is acceptable during the process. Which of the following deployment strategies can be used to meet these requirements? (Select TWO.)

Select all that apply

Rolling with additional batch

All at once

Immutable

Rolling

Blue/Green

Show answer & explanation

Answer: All at once; Rolling

Answer

The correct deployment strategies are All at once and Rolling.

The All at once and Rolling deployment strategies perform the update on the existing EC2 instances in the environment. Neither strategy provisions additional instances, ensuring that no extra costs are incurred. The All at once strategy updates all instances simultaneously (causing downtime), whereas the Rolling strategy updates instances in batches (temporarily reducing capacity), both of which fit within the allowed constraints.

Step-by-Step Solution

Analyze the resource and cost constraints.

The scenario requires zero additional budget for temporary resource overhead, meaning no new EC2 instances can be provisioned.

This rules out any deployment strategies that launch new instances (e.g., Rolling with additional batch, Immutable, and Blue/Green).

Analyze the availability and capacity constraints.

Temporary capacity reduction or complete downtime is acceptable during the update.

This allows for strategies that take instances out of service or deploy to all instances simultaneously.

Identify strategies matching both criteria.

All at once updates all existing instances at once (causing downtime but no extra cost). Rolling updates existing instances in batches (reducing capacity but no extra cost). Both satisfy the constraints.

Both strategies perform in-place deployments on existing instances without provisioning new ones.

Key Concept

AWS Elastic Beanstalk Deployment Strategies and Cost Trade-offs

Estimated Time:1m 0s

Question 754Question →

A development team is migrating a legacy backend API to run on Amazon ECS with the AWS Fargate launch type. The deployment process requires the Amazon ECS agent to authenticate with a private Amazon ECR registry to retrieve the Docker image and to configure log streams in Amazon CloudWatch. Which of the following IAM configuration steps are required to enable this setup? (Select two.)

Select all that apply

Assign an ECS Task Execution Role to the task definition containing permissions to pull the image from Amazon ECR and write logs to CloudWatch.

Configure the trust policy of the Task Execution Role to permit the Amazon ECS Tasks service principal (ecs-tasks.amazonaws.com) to assume the role.

Assign an ECS Task Role containing permissions to retrieve the container image from the Amazon ECR registry.

Store IAM User access keys in the application's config file inside the container to authenticate the ECR image pull.

Update the Task Execution Role trust policy to trust the Amazon EC2 service principal (ec2.amazonaws.com) to assume the role.

Show answer & explanation

Answer: Assign an ECS Task Execution Role to the task definition containing permissions to pull the image from Amazon ECR and write logs to CloudWatch.; Configure the trust policy of the Task Execution Role to permit the Amazon ECS Tasks service principal (ecs-tasks.amazonaws.com) to assume the role.

Answer

To successfully deploy the tasks on Fargate, you must assign an ECS Task Execution Role containing ECR pull and CloudWatch logging permissions, and update its trust policy to allow the ecs-tasks.amazonaws.com service principal to assume it.

The correct options state that we must assign an ECS Task Execution Role to the task definition containing permissions to pull the image from Amazon ECR and write logs to CloudWatch, and configure the trust policy of this role to permit the Amazon ECS Tasks service principal to assume it. This ensures that the ECS agent, running outside the container space, has the necessary permissions to retrieve the container image and initialize logging.

Step-by-Step Solution

Identify the entity performing infrastructure actions (image pull and log creation).

The Amazon ECS container agent runs before the application starts, requiring these permissions via the Task Execution Role.

Differentiating between task execution permissions (infra setup) and application permissions (runtime code) is necessary to choose the correct IAM role.

Configure the trust relationship on the Task Execution Role.

Trust policy is updated to allow the 'ecs-tasks.amazonaws.com' service principal to call AssumeRole.

Without the correct trust policy, AWS services cannot assume the IAM role to retrieve temporary security credentials.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role, and configuring appropriate trust relationships.

Estimated Time:1m 0s

Question 755Question →

A developer is packaging a web application for deployment to AWS Elastic Beanstalk. To configure custom environment properties and OS-level packages, the developer creates a configuration file named 01_setup.config. However, after deploying the application source bundle zip file, the developer notices that none of the custom configurations are applied to the EC2 instances. Where must the configuration file be located within the application source bundle for AWS Elastic Beanstalk to detect and process it?

Inside a folder named ebextensions (without a leading dot) placed at the root of the application source bundle

At the root of the application source bundle, with the line Transform: AWS::Serverless-2016-10-31 declared at the top of the file

Inside a folder named .ebextensions placed at the root of the application source bundle

Inside a folder named .ebextensions nested within the application's source code directory, such as src/.ebextensions

Show answer & explanation

Answer: Inside a folder named .ebextensions placed at the root of the application source bundle

Answer

Inside a folder named .ebextensions placed at the root of the application source bundle

AWS Elastic Beanstalk requires configuration files to be stored in a directory named '.ebextensions' at the root of the application source bundle. Files within this directory must have a '.config' extension to be parsed and executed during deployment.

Step-by-Step Solution

Identify the mechanism AWS Elastic Beanstalk uses for customization during deployment.

Elastic Beanstalk uses configuration files (ending in .config) to customize environment resources and software.

Understanding the built-in configuration mechanism of Elastic Beanstalk helps locate where configuration files must be stored.

Determine the required directory name and location requirements for these configuration files.

The files must be located in a folder named '.ebextensions' (with a leading dot) situated precisely at the root of the application source bundle.

Elastic Beanstalk's deployment agent scans only the root-level '.ebextensions' folder for files ending in '.config'.

Key Concept

AWS Elastic Beanstalk configuration files (.ebextensions) structure

Estimated Time:1m 30s

Question 756Question →

A developer manages an AWS CloudFormation stack for a production application. The stack defines an Amazon S3 bucket with the `DeletionPolicy` attribute set to `Retain`. To update the application's storage architecture, the developer modifies the CloudFormation template to change the name of the S3 bucket, which requires resource replacement. Before executing the stack update, the developer manually deletes the original S3 bucket out-of-band using the AWS CLI. During the stack update, a name collision error occurs for the new S3 bucket, causing the update to fail and begin rolling back. The rollback fails because the original S3 bucket no longer exists, and the parent stack becomes stuck in the `UPDATE_ROLLBACK_FAILED` state.

Which sequence of actions must the developer take to resolve this failure and successfully complete the name change?

Manually delete the parent stack to clean up the failed resources. Recreate the stack from scratch using the new template containing the unique bucket name, and copy the application data to the new S3 bucket.

Enable drift detection on the stack to automatically synchronize the physical state of the deleted S3 bucket with the template definition. Once the drift status is marked as synchronized, trigger a stack update using the new template containing the unique bucket name.

Invoke the `ContinueUpdateRollback` action and select the original S3 bucket as a resource to skip. Once the stack returns to a stable state, update the template to use a globally unique name for the new S3 bucket, and then run the stack update again.

Convert the S3 bucket name parameter to a dynamic reference pointing to an AWS Secrets Manager secret. Update the secret value with the new bucket name, and run the update operation to automatically bypass the rollback lock.

Show answer & explanation

Answer: Invoke the `ContinueUpdateRollback` action and select the original S3 bucket as a resource to skip. Once the stack returns to a stable state, update the template to use a globally unique name for the new S3 bucket, and then run the stack update again.

Answer

The correct answer is to use the `ContinueUpdateRollback` action and skip the deleted S3 bucket. Because the original bucket was deleted manually, CloudFormation cannot recreate it or revert its state during the rollback, which blocks the stack. Skipping the resource during the rollback process lets the stack reach a stable status (`ROLLBACK_COMPLETE` or `UPDATE_ROLLBACK_COMPLETE`). From there, the template can be fixed with a unique bucket name to avoid collision and update successfully.

Step-by-Step Solution

Perform the ContinueUpdateRollback operation.

The stack skips rolling back the deleted S3 bucket and successfully transitions to the `ROLLBACK_COMPLETE` state.

When a stack update rollback fails due to a missing resource, skipping that resource allows CloudFormation to bypass the block and bring the stack to a stable state.

Modify the CloudFormation template to specify a globally unique name for the new S3 bucket.

The template is prepared with a unique resource name that will not cause a name collision.

The initial stack update failed due to a name collision, so a unique name is required for successful creation.

Initiate a new stack update using the updated template.

The stack updates successfully, creating the new S3 bucket and completing the replacement.

Since the stack is now in a stable state, it can accept new update commands to apply the corrected configuration.

Key Concept

CloudFormation update rollback recovery and handling resource replacement drift

Question 757Question →

A developer is creating an Amazon ECS task definition to deploy a containerized application to AWS Fargate. The container needs to pull its image from Amazon ECR, write container logs to Amazon CloudWatch Logs, and query an Amazon DynamoDB table. Which two configurations must the developer specify in the task definition to meet these requirements?

Select all that apply

A task execution role that grants permissions to pull the container image from Amazon ECR and write logs to Amazon CloudWatch Logs

A task role that grants permissions to the application code running inside the container to query the Amazon DynamoDB table

A task role that grants permissions to the Amazon ECS agent to pull the container image from Amazon ECR

A task execution role that grants permissions to the application code to read data from the Amazon DynamoDB table

A container definition with hardcoded AWS access keys in the environment variables to authenticate the SDK client inside the container

Show answer & explanation

Answer: A task execution role that grants permissions to pull the container image from Amazon ECR and write logs to Amazon CloudWatch Logs; A task role that grants permissions to the application code running inside the container to query the Amazon DynamoDB table

Answer

The developer must specify a task execution role to grant ECR and CloudWatch access to the ECS agent, and a task role to grant DynamoDB access to the application code.

The correct choices specify a task execution role to grant the ECS agent permissions to pull ECR images and write CloudWatch logs, and a task role to grant the application code permissions to query DynamoDB.

Step-by-Step Solution

Identify the permissions needed for the ECS container agent to pull the Docker image and configure logging.

These infrastructure lifecycle actions are executed by the ECS agent, requiring the Task Execution Role.

The Task Execution Role provides the necessary permissions for the container agent itself before the application container starts.

Identify the permissions needed for the application code itself to interact with Amazon DynamoDB.

This business logic is executed inside the application container, requiring the Task Role.

The Task Role assigns permissions directly to the application container so the code can query AWS resources using SDKs.

Key Concept

Amazon ECS Task IAM Roles

Estimated Time:1m 0s

Question 758Question →

A gaming company is developing a new desktop application launcher. The launcher needs to authenticate players using external social identity providers and allow them to securely upload game save files directly to an Amazon S3 bucket. The developer wants to use Amazon Cognito to handle authentication and authorization.

Which two steps must the developer perform to meet these requirements?

Select all that apply

Configure an Amazon Cognito User Pool to handle player registration and integrate the social identity providers.

Create an Amazon Cognito Identity Pool, associate it with the User Pool, and map an IAM role to provide players with temporary AWS credentials.

Configure the Amazon Cognito User Pool to directly issue temporary AWS security credentials to authenticated players for S3 access.

Configure an Amazon API Gateway REST API with a custom Lambda authorizer that generates temporary AWS credentials for S3 uploads.

Configure an IAM trust policy that allows the desktop application's client credentials to directly call the AssumeRole API.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to handle player registration and integrate the social identity providers.; Create an Amazon Cognito Identity Pool, associate it with the User Pool, and map an IAM role to provide players with temporary AWS credentials.

Answer

Configure an Amazon Cognito User Pool to handle player registration and integrate the social identity providers, and create an Amazon Cognito Identity Pool, associate it with the User Pool, and map an IAM role to provide players with temporary AWS credentials.

To securely authenticate players via social identity providers and authorize direct S3 uploads, the system must separate authentication and authorization. A Cognito User Pool is set up to handle player authentication and social identity providers, returning tokens. A Cognito Identity Pool is set up to exchange those tokens for temporary AWS IAM credentials, granting permission to write to S3.

Step-by-Step Solution

Configure a Cognito User Pool to authenticate players.

Players can sign up, sign in, and federate with social identity providers to receive authentication tokens.

Cognito User Pools handle authentication and integration with identity providers.

Configure a Cognito Identity Pool.

The identity pool exchanges the User Pool tokens for temporary AWS credentials.

Cognito Identity Pools provide authorization to access AWS resources (like S3) using temporary AWS credentials.

Key Concept

Authentication and authorization federation using Amazon Cognito User Pools and Identity Pools.

Alternative Method

An alternative method is to configure a backend server that receives Cognito User Pool tokens, verifies them, and calls AWS Security Token Service (STS) to generate temporary credentials, returning them to the client. However, using Cognito Identity Pools is the direct, standard, serverless, and recommended solution.

Estimated Time:2m 0s

Question 759Question →

A developer is building a real-time collaborative whiteboarding application on AWS. The application requires a fast, external session store to track active users' presence and canvas coordinates. The session store must support advanced data structures (such as hashes and sets), low-latency pub/sub messaging for instant updates, and automatic failover to prevent session loss. Additionally, the developer must ensure that session data is automatically removed after $15$ minutes of inactivity.

Which TWO configurations or architectural decisions should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover enabled.

Use the Redis EXPIRE command to set a

900

-second Time to Live (TTL) on each session key.

Store session state in AWS Secrets Manager and configure a custom Lambda function to rotate and delete session tokens every

15

minutes.

Store session state in a DynamoDB table and configure a cron-scheduled Lambda function to run a Scan operation every

15

minutes to delete stale sessions.

Write session data to a local variable inside a Lambda function's handler to persist the state across subsequent invocations of the same collaborative room.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover enabled.; Use the Redis EXPIRE command to set a $900$ -second Time to Live (TTL) on each session key.

Answer

The developer should deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover enabled, and use the Redis EXPIRE command to set a

900

-second Time to Live (TTL) on each session key.

Deploying an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover provides the necessary support for hashes, sets, and pub/sub messaging along with high availability. Setting a

900

-second TTL using the Redis EXPIRE command ensures that the key is automatically evictable by Redis after

15

minutes of inactivity without requiring any external cleanup processes.

Step-by-Step Solution

Analyze the requirements for data structures, messaging, and high availability.

Identify that the cache layer must support advanced structures (hashes/sets) and pub/sub capabilities, which points to Redis rather than Memcached or DynamoDB DAX.

Redis is a key-value store that supports complex data types and built-in pub/sub commands, whereas Memcached is simpler and DAX does not offer native pub/sub capabilities.

Address the high availability and failover requirements.

Select ElastiCache for Redis with Multi-AZ and automatic failover enabled.

This configuration guarantees replication and automatic promotion of a replica to primary in the event of a primary node failure.

Determine the optimal mechanism for removing inactive session data after

15

minutes.

Use the Redis EXPIRE command on each key with a timeout value of

900

seconds.

Redis natively manages key eviction on expiration, avoiding the need for external clean-up scripts or inefficient database scans.

Key Concept

Selecting and configuring the correct external caching and session state mechanism based on application requirements (such as data structure support, replication, and TTL cleanup).

Question 760Question →

A developer is managing a web application infrastructure using AWS CloudFormation. The developer needs to configure the stack to retrieve a database password securely and ensure that the deployed infrastructure remains consistent with the template definition. Which two actions should the developer take to meet these requirements?

Select all that apply

Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference.

Use CloudFormation stack updates to perform all infrastructure modifications, avoiding direct manual updates to the resources.

Store the database password in a plaintext parameters block within the CloudFormation template to avoid external service calls.

Perform manual adjustments directly on resources via the AWS CLI to test changes, assuming CloudFormation drift detection will automatically sync those changes to the template.

Initiate a stack update while the stack is currently in the ROLLBACK_IN_PROGRESS state to apply fixes immediately.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference.; Use CloudFormation stack updates to perform all infrastructure modifications, avoiding direct manual updates to the resources.

Answer

Storing the database password in AWS Secrets Manager and referencing it dynamically, and using CloudFormation stack updates to perform all infrastructure modifications.

The correct actions are storing the database password in AWS Secrets Manager using dynamic references to prevent exposing credentials, and performing all changes via CloudFormation stack updates to avoid resource drift.

Step-by-Step Solution

Identify the requirement for secure password retrieval.

AWS Secrets Manager is selected because it securely stores secrets and supports dynamic references in CloudFormation.

This avoids exposing credentials in plaintext.

Identify the requirement to prevent configuration drift.

Deploying all changes through CloudFormation stack updates instead of manual out-of-band modifications.

This maintains resource consistency and avoids drift-related failures during future updates.

Key Concept

AWS CloudFormation best practices for resource consistency and secrets management

PreviousPage 38 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution